Lucene search

[email protected]CVE-2023-2567

HistorySep 19, 2023 - 11:16 a.m.

CVE-2023-2567

2023-09-1911:16:19

CWE-89

[email protected]

web.nvd.nist.gov

sql injection

nozomi networks

guardian

cmc

authentication

input validation

7.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

7.2 High

CVSS4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/SC:N/VI:L/SI:N/VA:L/SA:N

6.9 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.3%

JSON

A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain parameters used in the Query functionality, allows an authenticated attacker to execute arbitrary SQL queries on the DBMS used by the web application.
Authenticated users can extract arbitrary information from the DBMS in an uncontrolled way.

Affected configurations

NVD

Node

nozominetworkscmcRange22.6.0–22.6.3

nozominetworkscmcRange23.0.0–23.1.0

nozominetworksguardianRange22.6.0–22.6.3

nozominetworksguardianRange23.0.0–23.1.0

CPENameOperatorVersion
nozominetworks:cmcnozominetworks cmclt22.6.3
nozominetworks:cmcnozominetworks cmclt23.1.0
nozominetworks:guardiannozominetworks guardianlt22.6.3
nozominetworks:guardiannozominetworks guardianlt23.1.0

CPE	Name	Operator	Version
nozominetworks:cmc	nozominetworks cmc	lt	22.6.3
nozominetworks:cmc	nozominetworks cmc	lt	23.1.0
nozominetworks:guardian	nozominetworks guardian	lt	22.6.3
nozominetworks:guardian	nozominetworks guardian	lt	23.1.0

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Guardian",
    "vendor": "Nozomi Networks",
    "versions": [
      {
        "lessThan": "22.6.3",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThan": "23.1.0",
        "status": "affected",
        "version": "23.0.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "CMC",
    "vendor": "Nozomi Networks",
    "versions": [
      {
        "lessThan": "22.6.3",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThan": "23.1.0",
        "status": "affected",
        "version": "23.0.0",
        "versionType": "semver"
      }
    ]
  }
]

References

security.nozominetworks.com/NN-2023:9-01

7.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

7.2 High

CVSS4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/SC:N/VI:L/SI:N/VA:L/SA:N

6.9 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.3%

JSON

Related for CVE-2023-2567

prion1 cvelist1 nvd1 ics1